VAMT access is denied when trying to activate online
I am setting up a volume activation server and I followed the process adding my KMS host key and activating online without a problem. I then noticed a typo in the display name that I had given the host key as part of the install process and because I am a bit OCD I could not leave it alone so I went in and deleted it so I could add it back in without the typo. Now when I put the same KMS host key in and click commit to activate online I get a prompt that states 'access is denied'. What has gone wrong? I have restarted the server but still no joy.
August 26th, 2015 3:08am

"typo in the display name" ??

Are you doing ADBA?

KMS doesn't give you the opportunity to specify a "display name" for the key??

If you are doing ADBA, you can specify an "object name", and if you want to change that name, you would need to run the wizard again and "delete" the object, then run wizard again to create a new object with your desired display name.

If I've misunderstood, a screenshot might help me understand what you're seeing.

e.g. Figure#4 in this blog:

http://blogs.technet.com/b/supportingwindows/archive/2013/03/14/installing-volume-activation-services-role-in-windows-server-2012-to-configure-adba.aspx

and another useful example here:

http://blogs.technet.com/b/askpfeplat/archive/2013/02/04/active-directory-based-activation-vs-key-management-services.aspx

Free Windows Admin Tool Kit Click here and download it now
August 26th, 2015 5:38am

Yes I am doing ADBA and entering a display name for the activation object. I used the same key first time round and hit 'activate online' and then 'commit' and it worked just fine. I ran the wizard again to remove it correctly and then ran it again to add the key back in with the correct display name but it just keeps saying 'access is denied'. Is there a way to check that it has been removed cleanly? Can these only be activated once online and if so how do I reset it?



August 26th, 2015 10:56pm

It looks like it might be a permissions issue (access denied) on the Activation object in the AD.

Use ADUC or ADSIedit to check the permissions on the container and objects (if any) residing at: CN=Activation Objects,CN=Microsoft SPP,CN=Services,CN=Configuration

Check the event log on the server where you're trying this, there may be events logged there to reveal more.

Free Windows Admin Tool Kit Click here and download it now
August 27th, 2015 10:50am

I have looked at the permissions on 'Activation Objects' and they are fine (Domain admins have read write permissions). I have also tried adding my user with full control but still no success. I had already added and then deleted the object with this same process and user so I don't see why it would be a permissions issue anyway as it worked first time around.

I have also check the event log and there are no errors. When I run the 'activate online' process there are a number of events registered but none are an error or point towards a cause. There are events 'Security-SPP' numbers 900, 1066, 1003, 902, 1013, 903 registered in that order every time I run the process. They are all successful in what they are trying to do.

August 30th, 2015 7:46pm

Just a bit of an update on this issue. I am still not able to get this server working with ADBA. I also tried to configure it as a KMS server but get an error message 'The Software Licensing Service reported that the action requires administrator privilege'. I am logged in as a user in the Domain Admin and Enterprise Admin groups.

This machine is not a DC so as a test I tried to add the KMS service to one of my DC's but get the same errors. I did however get a minor move forward in that if I run the Volume Activation Tools on my DC and remotely manage my non DC I am able to configure it as a normal KMS server but still not ADBA (all done as the same user). This is obviously not a very good fix as we will have to forever use one server to manage the service on another.

Free Windows Admin Tool Kit Click here and download it now
September 2nd, 2015 12:40am

Hi,


I am trying to involve someone more familiar with this issue. There might be some time delay. Appreciate your patience.


Thanks for your understanding and support.

September 2nd, 2015 7:33am

Thank you Alex for picking this up. I really need this resolved as I have realized that the non DC server that I have installed KMS on is not an R2 server and therefore will not accept my 2012R2/Windows 10 KMS key. Just another issue to throw into the mix.
Free Windows Admin Tool Kit Click here and download it now
September 3rd, 2015 11:12pm

Hi,

Just because you are Domain Admin and Enterprise Admin doesn't necessarily mean that you are local admin. I have worked in environments wher domain admins and enterprise admins were removed from local admins group on some secure file servers and SQL servers. We were able to log in locally and examine logs and monitor services, but we were unable to to do much more. It was our duty to report any unusual behavior to the dedicated team(s).


  • Edited by Les52 Friday, September 04, 2015 7:47 AM
September 4th, 2015 7:47am

I know what you mean about being Domain/Enterprise admin but not local. The thing is the recommended setup for ADBA is to run on a DC so there are no local admins. I have checked and my domain Admin user account is also in the local administrators group on the machine that I am trying to install it on (this is my non DC machine). I am still getting access denied though.
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2015 7:33pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics